Your memories belong to you.

What stays on your iPhone

Later stores the child profiles, optional birthdays and avatars, words, notes, letters, photos, recordings and short videos you choose to keep. It also stores drafts, earlier text versions, favorites, earned capsules and your reminder and privacy preferences. Search and media preparation run on your device. No separate Later account is required for your private archive. Family sharing uses Sign in with Apple, with an additional parent-approved device option for invited children.

The native app contains no advertising, session replay or runtime generative AI. We do not use your family content to train AI models. Your private archive uses your device and private iCloud storage; choosing family sharing sends shared copies to the family service described below. Imported photo and video copies are optimized in the app and do not retain source location metadata.

Optional analytics, diagnostics and feedback

With “Help improve Later” enabled, we use PostHog to understand which parts of Later work well and fix failures. In releases through 2.5.1 (61), this choice is off by default. The next app update enables it by default when no preference has been saved; an existing off choice stays off. You can turn it off anytime in Settings → Help improve Later. Turning it off does not restrict your archive, letters or family sharing.

Usage reports include actions such as completing an onboarding step, saving a memory, viewing a membership offer or accepting an invitation, together with limited categories and counts, app and operating-system versions, device model and a randomly generated installation identifier. This identifier is pseudonymous, not an Apple advertising identifier; it is not linked to your Later family account. We do not send names, birthdays, private memory or letter content, media, invitation links or account credentials through analytics. There is no screen recording or session replay.

Crash diagnostics include technical stack traces and app/device information. Free-form exception messages and private paths are filtered before transmission. Reports may wait on your device until a connection is available or until the next app launch. Turning the choice off stops new reports and clears pending analytics data; it does not automatically erase reports already received. Our provider necessarily processes network connection information to receive reports; location enrichment is disabled. We use these reports for Later’s own product improvement, not cross-company advertising or data brokerage.

Later also checks operational feature switches with PostHog so we can safely enable or pause optional features. These checks work independently of optional analytics and use a shared app-distribution identifier, not your account or installation identifier. No family content or usage events are sent by these checks. The provider receives the network connection information needed to respond; location enrichment is disabled.

When you explicitly send feedback, we send the message you type, its category and the app version to PostHog, even if optional usage analytics is off. No archive content or screenshots are attached automatically, and each submission uses a separate random identifier. Please avoid including private family information. For a reply or a deletion request, contact [email protected].

PostHog processes these reports on our behalf in our EU-hosted project under its service terms. Our current free plan retains analytics for up to one year; contact us for information about an identifiable report or to exercise your privacy rights. Disabling analytics is always available in the app. PostHog privacy policy.

Subscription verification

For Together, Later sends Apple-signed subscription information to the family service to verify the capsule owner's Pro access, including eligible Apple Family Sharing entitlements. This includes product and transaction identifiers, expiration and revocation dates, and a family account identifier when available. Apple subscription notifications keep this status current when the owner is offline. Purchase identifiers may be retained after family account deletion to prevent duplicate claims and support restoring an active membership; family content is deleted as described below.

iCloud and Apple services

Later connects to iCloud as part of the app experience when your Apple Account is available. Your archive is uploaded to private CloudKit storage associated with that account. Memories can still be saved locally when iCloud needs attention; the app shows connection and sync status. Apple provides this service under its own terms and privacy policy. Availability depends on your account, connection and storage. Later keeps a local account identifier hash to separate archives when accounts change. Sync can propagate edits and deletions; it is not an independent backup.

Apple processes subscriptions and payments. Later reads verified StoreKit transaction information to determine access and eligibility; we do not receive your payment-card details. Apple may provide app diagnostics and App Store reports under your Apple settings.

Apple privacy policy

When you choose family sharing

When you choose to share, creating a shared capsule uploads that child's profile and selected archive to Later's family service. New letters are excluded from this relay and use the separate iCloud invitation described below. Letter copies previously shared by older beta versions may remain on the relay under their earlier access policy: only the author can read them before their date; an undated letter remains author-only. Previously downloaded copies cannot be recalled.

The service stores shared media and text, child profile information, a hashed Apple sign-in identifier, encrypted Apple authorization credentials, session identifiers, invitation and membership records, access dates and authorship. We do not request your email address from Apple. The service uses this information to authenticate members, deliver shared memories, enforce access dates and restrict changes to the owner or a memory's author. Hosting also processes connection information needed to serve and protect requests.

Shared content is encrypted during transport and encrypted in server storage with service-managed keys. This is not end-to-end encryption: the service can decrypt content to provide it to authorized family members. Only people with an accepted invitation can request a capsule's content. The service checks capsule access and any legacy letter’s opening date on content requests, independently of the owner's phone; the recipient needs a connection to first download it. A child invitation links the accepting Apple account, or a device explicitly approved by the capsule owner, to the selected capsule’s child profile. Connected family members can see each other’s invitation labels and child/adult roles; an adult’s private capsule and portrait are not included in this family overview.

For a child who cannot use Sign in with Apple, the capsule owner can approve a device by entering the six-digit code displayed on that device. Approval requests expire after 15 minutes. We store a random child-access identifier, a hashed device credential and invitation/approval records; this path does not request an email address, password or Apple authorization credential from the child. The device receives viewing access only to the assigned capsule. Approving a replacement device revokes the previous device’s session while preserving the child’s recipient identity. Removing access stops future downloads but does not delete saved copies. Later usage events are suppressed for parent-approved child sessions, and their subscription proofs are not sent to the family service. iCloud access remains governed separately by Apple and parental settings.

The family service delivers shared copies between people; your device and private iCloud archive remain your main storage. After every intended member confirms saving the current version, the shared payload becomes eligible for removal after a recovery period of 14 days by default. Cleanup is being verified during the beta and may retain these copies longer until enabled. This period is configurable by the service operator. Pending invitations and future opening dates delay cleanup. Older app versions that do not confirm delivery also delay cleanup. After recovery expires, a new or missing copy may need another family device with that memory to open Later online and resend it. Access, version and delivery records remain to coordinate this. Explicit deletion can remove shared copies sooner.

The owner chooses immediate or scheduled access and viewing or contribution permission. Contributors can add memories and edit their own; the owner manages everything. Invitations are single-use and must be accepted within 30 days. Removing access prevents further downloads and contributions but cannot retract copies already downloaded, exported, backed up or synced into a recipient's private iCloud archive.

You can delete your family sharing account in the app. This removes your shared capsules and your contributions from the active family service, revokes Apple authorization and ends access to capsules you own. Anonymous deletion markers remain so other devices can remove obsolete shared records. Your private archive and copies held by recipients remain separately. The family service runs on Cloudflare Workers and Durable Objects. Shared media is encrypted in private R2 buckets with EU jurisdiction, including a separate recovery copy. Metadata uses a Western Europe placement preference; this preference is not an EU residency guarantee. Deletion removes shared media from both active buckets; metadata recovery history can remain for up to 30 days. The former Vercel address forwards requests to Cloudflare for older app versions. An inactive Neon migration recovery database is temporarily retained. Provider support, security and network operations may involve other locations under their published terms. Your primary private iCloud archive is separate from these services.

Cloudflare privacy policy · Vercel privacy notice · Neon privacy policy

Optional family notes on widgets

If you enable family notes, connected family members with contribution access and Pro coverage can send you short notes or references to memories you already share. Receiving is free. The family service stores note text encrypted with service-managed keys, sender and recipient identifiers, and any shared-memory reference for a 24-hour delivery window. This is not end-to-end encryption. No additional photo, recording or letter attachment is uploaded by this feature. Expired notes are excluded immediately and removed from active storage during periodic cleanup; provider recovery history may retain encrypted records for up to 30 days.

Apple Push Notification service receives a device token and a content-free background update signal, never the note, a person’s name or a photo. Encrypted device tokens are tied to your family session and removed on sign-out, opt-out or after 90 days without registration. Apple controls background delivery and widget refresh timing. Opening Later also checks for waiting notes.

You choose whether to show family notes, and can disable them in widget settings. App lock and widget preview settings also apply. Notes disappear from Later’s widget selection after 24 hours; iOS may retain a previous snapshot until it refreshes. Letters and private capsules cannot be sent through this feature.

Letters for later

When you send a new sealed-letter invitation, Later encrypts a snapshot of the letter and its attachments on your device and shares it privately through Apple’s iCloud. After acceptance and a successful save, the recipient has a separate encrypted packet and its key in their private iCloud, plus a local copy. Removing the original share cannot retract that independent copy. The author’s original remains separate. Availability still depends on the recipient retaining their account, storage or an export.

The opening date is enforced by Later’s interface. It is not a cryptographic time lock: someone with access to the recovery packet and key can recover the content outside Later before that date. Once saved on a device, a letter can open at or after its date without the author’s phone or Later’s backend being online. Device date changes can affect an app-enforced date. Exports include recovery packets and keys; protect them as carefully as readable letters.

If you choose server key recovery for a connected family capsule, Later stores only the letter snapshot identifier, encrypted recovery key, opening date, author and authorized recipient/recovery-parent identifiers. The key endpoint does not accept letter text or attachments. Keys are encrypted with service-managed keys; this is not a zero-knowledge service. The author and explicitly nominated eligible recovery parents can retrieve a key; other named recipients must wait until its date. Access revocation prevents future server recovery, but cannot retract a key already obtained. Key records remain until deleted with the relevant author account or shared capsule, independently of the ordinary-memory recovery period.

A recovery key cannot recreate missing content. Invite another parent through iCloud too if you want them to hold an independent copy. Your iCloud copies, exports and recipient copies remain separate from family-service account deletion. No service can guarantee storage or account availability for decades; keep independent exports of irreplaceable letters.

Permissions and previews

Camera and microphone access are requested when you choose to capture media. The system photo picker lets you choose what to import. Optional app lock uses device authentication; Later does not receive your face, fingerprint or device passcode.

Later requests periodic background refresh to synchronize family deliveries. iOS controls availability and timing; when protected archive files are unavailable because the device is locked, sync waits. Foreground sync remains available. Background refresh does not send reminder notifications by itself.

Reminders are scheduled locally. Letter-writing reminders are off by default; you can choose a monthly or yearly cadence and turn it off at any time. Opening-date notifications for received letters are optional and contain no letter content. Family previews in widgets and notification photos require your choice. These previews can be visible outside the app. App lock turns family previews off. iOS may retain a previously displayed snapshot after a setting changes. Letter bodies are excluded from widgets and notifications.

Export, retention and deletion

You can read and export existing memories without an active subscription. Exports contain your chosen archive and media; protect the destination and only share with people you trust. An exported copy can be retained by its recipient.

Deleted memories remain recoverable for 30 days and are then removed from the active archive when Later next runs. You can delete them permanently sooner. Saved text versions are removed with their memory. Earned capsules remain earned. Interrupted media, migration recovery copies, previous account archives, Apple backups and copies you exported can remain separately; deleting a memory does not recall these copies. Unfinished media has its own export and delete controls.

When updating from Shortbook, its previous profile and preferences remain on your device and can be exported from settings. They are not uploaded as childhood memories.

Families and contact

Parents and guardians manage child profiles and family invitations. Family sharing is private; there are no public profiles or public posts. An invited child can use an eligible Apple sign-in account or ask the capsule owner to approve their device. iCloud features still require an available Apple Account managed according to Apple's age and family-account requirements. A guardian should decide what to share and when. Only record or share content you have permission to keep and share.

If you contact [email protected], we receive the address and information you include so we can respond. Please avoid sending private family media unless it is needed for your request. You can ask about this notice or request deletion of information you supplied directly to us. We cannot retrieve a local-only archive from your phone.

Visiting this website is separate from using the app; the website privacy policy describes the website. Material changes to the app's handling of data will be reflected in this notice.